diff --git a/lib/hypervisor/qemu/config.go b/lib/hypervisor/qemu/config.go
index f00b1a5af..030ac06fb 100644
--- a/lib/hypervisor/qemu/config.go
+++ b/lib/hypervisor/qemu/config.go
@@ -29,6 +29,10 @@ func buildArgs(cfg hypervisor.VMConfig, machine MachineType) []string {
 		// Do not allow a host qemu.conf to add devices outside microvm's
 		// documented eight virtio-mmio-device limit.
 		args = append(args, "-no-user-config")
+		// Pin upstream's default microvm firmware. Some distros point
+		// bios-microvm.bin at SeaBIOS instead, whose ACPI tables omit the
+		// IOAPICs and crash the guest kernel during early boot.
+		args = append(args, "-bios", "qboot.rom")
 	}
 
 	// CPU configuration
diff --git a/lib/hypervisor/qemu/config_test.go b/lib/hypervisor/qemu/config_test.go
index 71e8080af..27d69b2e1 100644
--- a/lib/hypervisor/qemu/config_test.go
+++ b/lib/hypervisor/qemu/config_test.go
@@ -249,6 +249,7 @@ func TestBuildArgs_MicroVM(t *testing.T) {
 	args := buildArgs(cfg, MachineTypeMicroVM)
 	assert.Contains(t, args, "microvm,accel=kvm")
 	assert.Contains(t, args, "-no-user-config")
+	assert.Contains(t, args, "qboot.rom")
 	assert.Contains(t, args, "virtio-blk-device,drive=drive0")
 	assert.Contains(t, args, "virtio-net-device,netdev=net0,mac=02:00:00:ab:cd:ef")
 	assert.Contains(t, args, "vhost-vsock-device,guest-cid=123")